Analysis
-
max time kernel
152s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 20:58
General
-
Target
50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce.exe
-
Size
68KB
-
MD5
13ba834cea20e5b408e7ad03919aa8b3
-
SHA1
f8466b5f4b8474a2c38d66f138e8c240b48fcedd
-
SHA256
50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce
-
SHA512
3b6b96202dd404df78f49c26f1c246e226f40eed90f25d1dc84032d70d5165ce91549d858a74e69708ae5579ba41e0695c9a4d3d5b30c150ea1668130bcdd55b
-
SSDEEP
768:BctliTdOpOpAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:OtIx1AcqOK3qowgnt1d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce.exe"C:\Users\Admin\AppData\Local\Temp\50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD58a4f96d3c8562f4dc8a52cae5db81f4e
SHA1ae1d6b6d768a9938317e9c509327d642ee2f6570
SHA256dcca0a171c1ee6042674ac1f2463b8f456012bfbc5f47a8b4d58eb6c2bddf840
SHA5126e1fc7975807366dea593215d199cec9f22fbbd95dbddda989e07d9ae26342b39c688369567e0cf630b51e0008c7cbe3429987398e2bff4b8e053e09d7cb482e
-
Filesize
68KB
MD58a4f96d3c8562f4dc8a52cae5db81f4e
SHA1ae1d6b6d768a9938317e9c509327d642ee2f6570
SHA256dcca0a171c1ee6042674ac1f2463b8f456012bfbc5f47a8b4d58eb6c2bddf840
SHA5126e1fc7975807366dea593215d199cec9f22fbbd95dbddda989e07d9ae26342b39c688369567e0cf630b51e0008c7cbe3429987398e2bff4b8e053e09d7cb482e
-
Filesize
84KB
-
Filesize
84KB
-